Administrator-only file read and deletion via traversal

Directory traversal in Import and export users and customers 1.24.2 and earlier allows remote authenticated users to read or delete server files. The recurring-import path handler passes an administrator-supplied path to file-processing and cleanup operations without restricting it to CSV import storage. Administrator access to WordPress is required; successful exploitation exposes sensitive configuration data and can remove any file writable by the web server.